CVE-2026-73695

Summary

Control Web Panel (CWP) before version 1.16 has a path traversal flaw in services/users/index.php where an unsanitized 'module' parameter allows attackers to inject directory traversal sequences into an include path, leading to local file inclusion and arbitrary PHP code execution.

Exploitability

Exploitation requires low-privileged authentication (PR:L) and no user interaction, with straightforward exploitation possible via crafted HTTP requests targeting the vulnerable endpoint.

Blast radius

Successful exploitation grants full compromise of confidentiality, integrity, and availability within the CWP user panel context, potentially affecting all hosted user accounts and backend services accessible to the web server.

Detection

Look for HTTP requests to /services/users/index.php containing %2e%2e/ or similar encoded directory traversal sequences in the module parameter, especially when followed by .php extensions or non-standard file paths; also monitor for unexpected PHP file inclusion attempts from user-controlled input in server access logs.

Prioritized remediation

Upgrade to CWP version 1.16 or later, which patches the path traversal vulnerability in services/users/index.php by properly sanitizing the module parameter before use in include paths.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.